Bus Atha Cliath/Dublin Bus -v- The Data Protection Commissioner [2012] IEHC 339 (08 August 2012)

Judgment Title: Bus Atha Cliath/Dublin Bus -v- The Data Protection Commissioner

Neutral Citation: [2012] IEHC 339

High Court Record Number: 2011 123 CA

Date of Delivery: 08/08/2012

Court: High Court

Composition of Court:

Judgment by: Hedigan J.

Status of Judgment: Approved

Neutral Citation Number: [2012] IEHC 339

THE HIGH COURT

(CIRCUIT COURT APPEAL)

Record No. 123CA/2011

BETWEEN:-

BUS ATHA CLIATH/DUBLIN BUS

THE DATA PROTECTION COMMISSIONER

APPELLANT

RESPONDENT JUDGMENT of Mr. Justice Hedigan delivered the 8th day of August 2012

1. The appellant is is a wholly owned subsidiary of the state-owned Córas Iompar Eireann Group and has offices at 59 Upper O'Connell Street, Dublin 1. The respondent was established pursuant to the Data Protection Act 1988. The respondent's office is located at Canal House, Station Road, Portarlington, Co. Laois.

Background Facts
2.1 The matter comes before the High Court in the present instance as an appeal on a point of law from a decision of the Circuit Court made on the 5th of July 2011, in which Judge Linnane upheld a decision of the Data Protection Commissioner to issue an Enforcement Notice, requiring the appellant to provide a copy of CCTV footage to a Ms Margaret McGarr.

2.2 The background to this matter is as follows; on the 3rd October 2008, Ms McGarr allegedly fell on a Dublin Bus, the property of the appellant herein. On the 19th October, 2009, Ms McGarr commenced personal injury proceedings arising out of her alleged fall. Following receipt of the formal notice of Ms McGarr's application to PIAB, the appellant entered into correspondence with her Solicitors, informing them of the existence of CCTV footage, and inviting them to view the footage. On the 29th January, 2010, the said Solicitors attended at the office of the appellant and viewed the CCTV footage.

2.3 On the 12th February 2010, an access request, pursuant to s. 4 of the Data Protection Act 1988 (as amended) was served by Ms McGarr upon the appellant, requesting a copy of any information including video records the appellant held in respect of her. On the 16th February 2010, that access request was rejected by the appellant, on the grounds that any such information was prepared in anticipation of potential litigation, and as such was privileged. On the 18th May 2010, the Data Protection Commissioner, notified the appellant by letter of the commencement of an investigation into the matter. On the 23rd June 2010, a personal injuries summons was issued in the High Court by Ms McGarr as against the appellant.

2.4 On the 20th January 2011, an Enforcement Notice requiring the appellant to provide a copy of the CCTV to Ms McGarr, was issued by the Data Protection Commissioner. On the 7th February 2011, the appellant appealed the decision of the Data Protection Commissioner to the Circuit Court. On the 5th July 2011, Judge Linnane upheld the decision of the Data Protection Commissioner. The within proceedings are an appeal from the decision of Judge Linnane.

Appellant's Submissions
3.1 The appellant submits that Judge Linnane in giving her Judgement in respect of this matter, and in allowing the Enforcement Notice of the respondent to stand, erred in law in holding that, subsequent to the commencement of legal proceedings, the High Court did not have the sole competence to deal with and adjudicate upon all of the matters arising between the parties, Margaret McGarr and Dublin Bus, and relating to the accident which occurred on the 3rd October, 2008.

3.2 The appellant contends that the proper forum for adjudicating on matters of Discovery between the parties in the proceedings of "McGarr v Dublin Bus" is the court which has seisin of the proceedings, in this instance, the High Court. When conducting his investigation into this matter, pursuant to s.10 (1) (a) of the Act, the respondent should have taken account of Ms Me Garr's motive for seeking the CCTV footage. It is not contested that Ms McGarr seeks this material solely as a means of furthering her litigation against the appellant. It is also not contested that the respondent was put on notice in the course of his investigation, of the commencement of proceedings between the parties. In those circumstances, the respondent should have advised Ms McGarr that the appropriate way to proceed in seeking material from the appellant, in the context of litigation taken against the appellant, was by way of discovery.

3.3 The appellant submits that any attempt to seek disclosure outside of the High Court is a mistaken and inappropriate attempt to usurp the function of the High Court. In Murphy v Corporation of Dublin [1972] IR 215, the Supreme Court unanimously held that it was the Courts who retained sole power to order discovery between parties. Walsh J held as follows at page 233:-

"Under the Constitution the administration of justice is committed solely to the judiciary in the exercise of their powers in the courts set up under the Constitution. Power to compel the attendance of witnesses and the production of evidence is an inherent part of the judicial power of government of the State and is the ultimate safeguard of justice in the State. The proper exercise of the functions of the three powers of government set up under the Constitution, namely, the legislative, the executive and the judicial, is in the public interest. There may be occasions when the different aspects of the public interest "pull in contrary directions" to use the words of Lord Morris of Borth-y-Gest in

Conway v Rimmer.

If the conflict arises during the exercise of the judicial power then, in my view, it is the judicial power which will decide which public interest shall prevail."

In relying on the constitutional principle of the separation of powers, Walsh J held that the courts are the sole body constitutionally mandated to decide if a document is to be discovered or produced. Walsh J. went on to state at 234 that:-

"It is ... impossible for the judicial power in the proper exercise of its functions to permit any other body or power to decide whether or not a document will be disclosed or produced. In the last resort the decision lies with the courts so long as they have seisin of the case."

This decision has remained the fundamental cornerstone of the law of discovery in this state, and has repeatedly been upheld by the Supreme Court as the correct interpretation of the law in this regard.

3.4 It is the clear position of the courts in this jurisdiction that it is the judicial power which retains the "sole competence" and discretion to order, or to deny, the production of documents in circumstances where parties have submitted themselves to the jurisdiction of the Court. Any attempt to usurp this competence by some other body, or to bypass the judicial process by effectively obtaining discovery by another means, must involve the subversion of the jurisdiction of the Courts. The appellant submits that the role of the Data Protection Commissioner is protecting the data of the citizens of the state. The Commissioner should have no role in the conduct of litigation; no such role was conceived by the drafters of the Data Protection Acts.

3.5 There is very little jurisprudence on Data Protection Law in this jurisdiction, there is however a body of relevant English case law. While the respective English and Irish legislation is not identical there is nevertheless a strong similarity between them. Both emanate from Directive 95/46/EC and both seek to compel, broadly, the same effect. Section 7 of the UK's Data Protection Act 1998 deals with the "right of access to personal data", the purpose of this right was considered in Durant v Financial Services Authority [2003] EWCA Civ 1746 where Auld LJ held as follows at paragraph 27:-

"In conformity with the 1981 Convention and the Directive, the purpose of section 7, in entitling an individual to have access to information in the form of his "personal data" is to enable him to check whether the data controller's processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides, for example in sections 10 to 14, to protect it. It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved. Nor is to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties."

3.6 The appellant submits that by affording an appellant the right to first appeal to the Circuit Court, and thereafter to the High Court on a point of Law the drafters of the legislation clearly intended that the Courts would have discretion in deciding upon the interpretation of the Acts. Therefore the purposive effect of the Acts provisions must be considered, and it is on this basis that the appellant submits that the dicta of Auld LJ in the Durant case retains very strong persuasive value in terms of the interpretation of the Irish Acts. In England the "purpose" of the access right in Data Protection Law was expressly held not to be "to assist [individuals], for example, to obtain discovery of documents that may assist them in litigation or complaints against third parties."

3.7 The appellant submits that the High Court should take cognizance of the dicta of Auld LJ that the purpose of Data Protection Law is not:-

"to assist [a litigant]... to obtain discovery of documents that may assist him in litigation or complaints against third parties".

It is the High Court which retains seisin of the case between Ms McGarr and the appellant and it is the High Court that has the sole competence to adjudicate upon all of the matters arising between the parties.

Respondents Submissions
4.1 The appellant herein seeks to challenge a decision made on the 25th of January 2011, by the Data Protection Commissioner to issue an enforcement notice. The appellant appealed this decision to the Circuit Court but was unsuccessful in that appeal. The appellant has now appealed that decision to this Court. In the Circuit Court Judge Linnane held inter alia that the case law in England that the appellant had sought to rely on was not relevant as the English legislation conferred discretion as to whether or not to grant an order for access. Judge Linnane dismissed the appeal. The respondent submits that the Circuit Court was correct in its finding.

4.2 Section 26(3) (b) of the Data Protection Act 1988 (as amended) provides that where the Circuit Court has determined an appeal from a decision made by the Data Protection Commissioner, an appeal may be brought to the High Court on a point of law against such a decision. No indication is given in the Acts as to what the test to be applied in the appeal is. In Ulster Bank v Financial Services Ombudsman [2006] IEHC 323, the following test for an appeal pursuant to section 57CL Central Bank and Financial Services Authority of Ireland Act 2004 was laid down by Finnegan P. at 4:-

"To succeed on this appeal the plaintiff must establish as a matter of probability that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In applying the test the Court will have regard to the degree of expertise and specialist knowledge of the Defendant. The deferential standard is that applied by Keane C.J. in

Orange v The Director of Telecommunications Regulation & Anor

and not that in

The State (Keegan) v Stardust Compensation Tribunal

The above test has been subsequently followed by the Circuit Court in a number of Data Protection appeals and by the High Court in a number of appeals from the Financial Services Ombudsman. Thus it has become well-established at this stage as the correct test to apply in the context of statutory appeals. The respondent submits that the serious and significant error test is of long standing in Irish law and is the appropriate standard to apply to this appeal.

4.3 In Nowak v Data Protetcion Commissioner, (unreported, 7th March 2012) Birmingham J. held that the Ulster Bank test was the appropriate test to apply in a data protection appeal. In that case Birmingham J. upheld a decision of the Circuit Court to dismiss an appeal against a decision of the Commissioner (both on jurisdictional grounds and on the merits). Birmingham J held at page 9 that:-

"I am satisfied that the approach adopted by Finnegan P. is the one that would have been appropriate to apply had an appeal been available. In particular it seems to me that it would have been appropriate for the court to have regard to what Finnegan P. referred to as the deferential standard, when deciding to substitute its own view for that of the Data Protection Commissioner on the issue of whether an exam script constituted personal data."

That case is currently under appeal to the Supreme Court. It is submitted on behalf of the respondent that in the present case the decision of the Data Commissioner did not contain a serious and significant error or a series of such errors to use the words of Finnegan P. It is further submitted that the Circuit Court did not make an error of law in rejecting the appeal. The question for the Circuit Court was not what it would have done if it had been faced with the complaint. The question for the Court was whether the Commissioner exercised his own discretion in such an arbitrary manner as to render it a decision that no Commissioner could have reached. It is submitted that the answer to that question is no. On the basis of the material before him the Commissioner could not have reached any other decision. The applicant seeks to argue that the Commissioner should have taken into account the requesters motive for wanting the data. The respondent submits that a person's fundamental right to access their personal data under the Acts is not conditional upon their establishing a good motive for wanting their personal data and the Commissioner is not required to demand of a requester why they want their personal data.

4.4 It is submitted that if the drafters of the legislation wished to impose limitations on the right of access to personal data in circumstances where litigation has been instituted they would have done so expressly. If the Court were to read a new exception into the Acts based around the idea of there being legal proceedings then it is far from obvious how the Court would draft this new exception. Some of the basic problems that would arise in drafting such an exemption would be as follows:-

"(i) would it apply to proceedings that are merely contemplated or to proceedings that have actually commenced?

(ii) what about a case where someone wants to see their personal data in order to decide whether or not they might want to bring legal proceedings?

(iii) what about a case where the requester has not sought discovery in the legal proceedings?

(iv) would the rights under the Act in respect of the personal data in question be terminated forever or merely suspended until the legal proceedings conclude?

(v) could the data controller cross-examine the requester as to what their motives are in seeking access to their personal data?

(vi) if the data controller can so cross-examine the requester what duty is there on the requester to reveal their future intentions?"

Each of the above questions give rise to difficult issues that are properly a matter for legislative policy choice. Even if the drafters of the legislation had been of the mind to include such an exception in the Acts then the question would arise as to whether its creation placed Ireland in breach of its obligations to transpose the Data Protection Directives properly. As no such exception was included by the legislative drafters this issue does not arise.

4.5 The appellant's submissions refer to an attempt to subvert the jurisdiction of the courts. However there is nothing about making a data access request pursuant to the statutory right of access that amounts to subverting the jurisdiction of the courts. Indeed, quite the opposite, since the courts expect parties to see if they can obtain information from other sources before taking up the time of the court with a discovery request. Thus one of the tests for discovery is that the discovery request be necessary. If a motion for discovery comes before the court, all that the court will have seisin of is the issue as to whether the material is relevant and necessary to the litigation and so whether discovery should be ordered. On the other hand, the issue that the Commissioner had seisin of was the entirely separate and distinct issue as to whether the requester had a right of access to the CCTV footage under the Acts or not.

4.6 A person's right of access to personal data is a fundamental right. Indeed Article 16 of the Lisbon Treaty now makes express reference to the need to protect personal data and provides that "Everyone has the right to the protection of personal data concerning them." Thus it is submitted that any exemption to data protection law should be narrowly construed since it is an exemption from a fundamental right.

Decision of the Court
5.1 This matter comes before the High Court as an appeal on a point of law from a decision of the Circuit Court made on the 5th of July 2011, in which Judge Linnane upheld a decision of the Data Protection Commissioner to issue an Enforcement Notice, requiring the appellant to provide a copy of CCTV to a Ms. Margaret Me Garr. The background to this matter is as follows; on the 12th of February 2010, an access request, pursuant to s. 4 of the Data Protection Acts 1988 and 2003 was served upon the appellant by Ms. Me Garr requesting a copy of video records the appellant held in respect of her. On the 16th February 2010, that access request was rejected by the appellant on grounds that any such information was prepared in anticipation of potential litigation, and as such was privileged. Ms Me Garr had initiated proceedings against the appellant arising out of an alleged fall on one of the appellant's buses. On the 18th of May 20 I 0, the Data Protection Commissioner, by way of letter, notified the appellant of the commencement of an investigation into the matter. On the 20th of January 2011, an Enforcement Notice, requiring the appellant to provide a copy of the CCTV footage to Ms Mc Garr, was issued by the Data Protection Commissioner as against the appellant. On the ih of February 2011, the appellant appealed the decision of the Data Protection Commissioner to the Circuit Court. On the 5th of July 2011, Judge Linnane upheld the decision of the Data Protection Commissioner. This is the decision which the appellant now seeks to appeal.

5.2 The relevant legislation governing this matter is the Data Protection Acts 1988 and 2003. Section 10(1) of the Acts provides that:-

"(a) The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act have been, are being or are likely to be contravened in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of the opinion that there may be such a contravention.

(b) Where a complaint is made to the Commissioner under paragraph (a) of this subsection, the Commissioner shall-

(i) investigate the complaint or cause it to be investigated, unless he is of opinion that it is frivolous or vexatious, and,

(ii) if he or she is unable to arrange, within a reasonable time, for the amicable resolution by the parties concerned of the matter the subject of the complaint, notify in writing the individual who made the complaint of his or her decision in relation to it and that the individual may, if aggrieved by the decision, appeal against it to the Court under section 26 of this Act within 21 days from the receipt by him or her of the notification.

The appeal from the decision of the Data Commissioner is to the Circuit Court. The decision of the Circuit Court can in turn be appealed to the High Court on a point of law, as provided for in Section 26 (3) (b) of the Acts which states:-

"An appeal may be brought to the High Court on a point of law against such a decision; and references in this Act to the determination of an appeal shall be construed as including references to the determination of any such appeal to the High Court and of any appeal from the decision of that Court."

5.3 In this case the appellant has not, as required by Section 26 (3) (b), set out the point of law on which it wishes to appeal. The appellant's notice of appeal simply states:

"The Appellant, Bus Atha Cliath/Dublin Bus hereby appeals to the High Court sitting in Dublin at the first opportunity after the expiration of 10 days from the date of service hereof from the whole of the Judgment of the Circuit Court given herein on the 5th day of July, 2011 in Circuit Court Number 22 before Judge Jacqueline Linnane."

No attempt has been made in the notice of appeal to identify any points of law. From the Courts perspective this is completely unsatisfactory. Simply saying that you are appealing the whole of a judgment does not amount to a valid appeal on a point law. An appeal on a point of law is just that. The point of law should be identified and the submissions should be directed to that point. When pressed on the matter, the appellant did identify the point of law which it wished to raise on appeal as follows:-

"Whether the existence of legal proceedings between a data requester and a data controller precludes a data requester making an access request under the Act"

Notwithstanding the unsatisfactory notice of appeal, I indicated to the parties that I would deal with this appeal. However the parties were to strictly confine themselves to this narrow legal point. I also directed the parties to provide updated written submissions which also address just this net issue within seven days from the date of hearing. Both parties have provided amended submissions.

5.4 The right of an individual to access personal data processed by a data controller relating to that individual is contained in section 4 of the Data Protection Acts 1988. Section 4 provides as follows:-

"4. (1) (a) Subject to the provisions of this Act, an individual shall, if he so requests a data controller in writing:

(i) be informed by the data controller whether the data kept by him include personal data relating to the individual, and

(ii) be supplied by the data controller with a copy of the information constituting any such data.

The Data Protection Act 2003 imposes exceptions to the right of access where:

(a) the supply is not possible or would involve disproportionate effort, or

(b) the data subject agrees otherwise.

The appellant has not sought to argue that either of these two exceptions apply, instead it seeks to argue that an exception to the right of access to data should apply where there are legal proceedings between a data requester and a data controller. In advancing this proposition the appellant places heavy reliance on English case law.

5.5 It seems to me that the English case law relied on by the appellant is not relevant. What we are concerned with here is a right of access to personal data. The English cases were concerned with information whereby the requester was merely mentioned in documents that related to third parties and where there was a statutory discretion reserved to the court under the UK Data Protection Act 1988 as to whether to make an order directing compliance with a person's access request. No such discretion exists under the Irish Legislation. Furthermore the applicants in the English cases were seeking very large volumes of documentation. It was in the context of the exercise of that discretion that the courts considered matters such as why the requester wanted the information. However in this case we are dealing not with discretion but with the requester's statutory right to personal data.

5.6 In Durant v Financial Services Authority [2003] EWCA Civ 1746 Auld LJ was of the view that the purpose of UK Data Protection Act 1988 was not to assist Mr. Durant in obtaining discovery of documents that may assist him in litigation or complaints against third parties. In that case Mr. Durant was seeking information that might possibly refer to him, not because it was personal data, but because he was fishing for information that he could use in proceedings against third parties. That is not the case here since what the requester is seeking is clearly her own personal data. In addition, in Durant the requester was seeking documents that contained information about third parties and thus the question arose as to whether it was reasonable to disclose such information. The English legislation stated that a test of reasonableness applied to such a request. Therefore when the court came to exercise what it viewed as its discretion to direct access to such data, Auld LJ looked at the fact that Mr. Durant was fishing for information he could deploy in proceedings against third parties. By contrast, in the present case, none of the statutory exceptions applying, the requester has a right to access her personal data and so

discretionary issues are not a factor.

5.7 It seems to me that in effect the appellant is seeking to carve out a new exception in the Acts, to the effect that whenever a data requester has instituted litigation against a data controller he or she is precluded from making a data access request under the Acts. I accept the respondent's submission that if the drafter of the legislation wished to place such limitations on the right of access to personal data then they would have done so expressly. Thus in my judgment, the existence of proceedings between a data requester and the data controller does not preclude the data requester making an access request under the act nor justifies the data controller in refusing the request. I am not therefore satisfied that the appellant has raised a point of law giving rise to grounds for overturning the decision of the learned circuit judge. I must therefore dismiss this appeal.

BAILII: Copyright Policy | Disclaimers | Privacy Policy | Feedback | Donate to BAILII
URL: http://www.bailii.org/ie/cases/IEHC/2012/H339.html

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	High Court of Ireland Decisions
You are here: BAILII >> Databases >> High Court of Ireland Decisions >> Bus Atha Cliath/Dublin Bus -v- The Data Protection Commissioner [2012] IEHC 339 (08 August 2012) URL: http://www.bailii.org/ie/cases/IEHC/2012/H339.html Cite as: [2012] IEHC 339

High Court of Ireland Decisions